Illinois Limits Police Access to Data Stored by Third Parties
by Anthony W. Accurso
Illinois recently passed the Protecting Household Privacy Act (“PHPA”), which limits state law enforcement access to data stored by third parties, i.e., companies like Google and Facebook, requiring warrants in most circumstances, and establishing disclosure and retention limitations.
Both the Fourth Amendment to the U.S. Constitution and Article I, Section 6 of the Illinois Constitution protect people against unreasonable searches and seizures, and caselaw relating to warrant requirements and exceptions largely mirrors one another in applicable court rulings interpreting both provisions.
However, the slow erosion of protections against government intrusion into personal privacy over the last almost 50 years has led to unforeseen consequences in the digital age. In the 1970s, the U.S. Supreme Court created the “Third Party Doctrine,” providing an exception to the warrant requirement by ruling that a person has no privacy expectation in data willingly surrendered to a third party (such as your bank or telephone company).
The practical result (at the time) was that police could find out who you called and when but would still need a warrant to conduct a wiretap if they wanted the content of your communications.
Fast forward to the social media age, and the proliferation of messaging apps and cloud storage means that police can get a whole lot more information on a person—even the audio recorded in a person’s home by digital assistants like Amazon’s Alexa—something unimaginable in the 1970s.
Despite much delaying and gridlock at the federal level about addressing this problem, the state of Illinois has opted to (mostly) close this long-neglected loophole.
House Bill 2553 now requires any Illinois law enforcement agency to first obtain a warrant before obtaining household electronic data from a third party. This requirement may be waived with the “lawful consent of the owner of the household electronic device or person in actual or constructive possession of the household electronic device, excluding law enforcement personnel.”
It may also be waived where an officer believes delaying long enough to obtain a warrant will result in “imminent death or great bodily harm to a person,” but even then, the officer must obtain the warrant within 72 hours of obtaining the data.
The law also modifies the law relating to violations of the warrant requirement. Suppression of unconstitutionally obtained evidence is not always required under federal law, but suppression is now mandated in Illinois where the data were obtained in violation of the PHPA.
Further, law enforcement and any party disclosing information to the agency must “take reasonable measures to ensure the confidentiality, integrity, and security” of the data “during transmission to any law enforcement agency.”
Finally, the police are severely restricted with regard to sharing of the data and must destroy it after 60 days unless it is part of an ongoing investigation.
Illinois lawmakers are taking the digital privacy of their citizens seriously. After passing a separate digital privacy bill recently, the state allowed a class-action suit against Facebook for violating the state’s law—netting affected citizens $550 million—and recently greenlit another suit against Clearview AI for obtaining and storing user photos without user permission.
The PHPA is a significant improvement over federal laws like the Stored Communications Act (“SCA”) that govern federal agency access to similar material. Unfortunately, while this law applies to all state law enforcement, it does not prevent federal agencies from using the more relaxed standards under the SCA. This could allow Illinois agencies to bypass the state law by partnering with the feds to benefit from the looser federal rules.
But the feds are unlikely to pick up the load of all Illinois investigations and prosecutions that would otherwise be limited under the new law, so state police will have to learn to play by the new rules for the vast majority of cases.
In the following months and years, as Illinois courts issue decisions enforcing the new law, we’ll learn what actual limits apply—especially in state and federal partnerships—and see the ways police will attempt to get around the new restrictions.
Source: techdirt.com
As a digital subscriber to Criminal Legal News, you can access full text and downloads for this and other premium content.
Already a subscriber? Login
